Api manager

This hub aggregates every CVE we track for Api manager, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Api manager.

• CVE-2024-10302Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure4.0Aug 6, 2026
• CVE-2024-6832Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks5.9Aug 6, 2026
• CVE-2026-4249Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption8.6Jul 6, 2026
• CVE-2025-8591Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification6.1Jul 6, 2026
• CVE-2024-1248Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation4.8Jul 4, 2026
• CVE-2025-13475Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure3.5Jul 4, 2026
• CVE-2026-2053Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager8.3Jun 26, 2026
• CVE-2025-8325Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations6.3May 11, 2026
• CVE-2025-8154HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation5.3May 11, 2026
• CVE-2025-6024Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites6.1Apr 16, 2026
• CVE-2024-10242Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection6.1Apr 16, 2026
• CVE-2024-8010XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files3.5Apr 16, 2026
• CVE-2024-4867Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval5.4Apr 16, 2026
• CVE-2024-2374XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service7.5Apr 16, 2026
• CVE-2024-1524A local user can be impersonated when using federated authentication with Silent JIT Provisioning.7.7Feb 24, 2026